There is a keen demand for delivery of encrypted images, video, and music media streams over the Internet on consumer electronics using high-performance Internet protocol security (IP security, IPSec). At present, a conventional way is to utilize an encryption/decryption accelerator or hardware to offload IPSec processing to enhance its overall performance.
However, a paper entitled “The Design of the OpenBSD Cryptographic Framework” in Usenix Annual Technical Conference published by Usenix in 2003 identified an issue associated with the use of encryption/decryption accelerator or hardware. The issue is that transmission of small packets takes up longer cryptographic processing time compared with those that do not use a hardware cryptographic accelerator, which is due to the overhead of operating system kernel (OS kernel), data bus, and cryptographic processing hardware. More specifically, the processing of a small packet and an ordinary-sized packet will both incur overhead but for small packets, the entire system needs to process more overhead within a time unit, and must therefore pay a higher price for processing the transmission of small packets. Under such circumstances, even if cryptographic processing hardware is used, its cryptographic processing time cannot be effectively reduced.
Japanese Patent Publication No. JP2003069555 for “Encryption Device and Encryption/Decryption Processing Method” described a method and device for addressing the aforesaid issue. The solution is to examine the length of each packet to determine whether cryptographic processing is to be performed by a hardware cryptographic module or a software cryptographic module. If it is a small packet, cryptographic processing is performed by the software cryptographic module. If it is a large packet, cryptographic processing is performed by the hardware cryptographic module.
However, a processing circuit for the aforesaid selective use of the software or hardware cryptographic module requires examination of every packet, and is therefore very inefficient in transmission of video and audio streams where transmission rate is of major concern. In addition, the processing circuit also passes the small packet unconditionally to the software cryptographic module for processing without considering the overhead of a central processing unit or the system, which will lead to a drop in the efficiency of the entire system. There is thus a need to find a solution.